Isolation by construction, not by policy.

Every customer runs on their own control-plane deployment: a separate database, a separate encrypted vault, a separate hostname and auth token. There is no shared state between customers, so there is no cross-customer surface for a bug to leak through and no tenant filter that could be written wrong.

Compromising one instance exposes only that instance. Decommissioning removes your containers and volumes without touching anyone else.

Each instance encrypts its vault under its own master key, generated fresh at provisioning. Even if two instances shared a host, one customer's stolen disk cannot decrypt another customer's data.

Your git tokens and model credentials live only on Runners inside your own network. The control plane decides, gates, and remembers; it never holds the keys. Every payload it sends to a Runner is secret-free by design.

Runner connections are outbound-only and mutually authenticated (mTLS), with single-use, scoped enrollment tokens minted per customer.

Agents work on branches inside your GitHub or GitLab with the permissions you grant. They never push to protected branches and never deploy without your go. Your code is not used to train models. Leaving Loopsfinity takes nothing more than revoking access; everything produced is already in your repos.

Every agent run, gate decision, and state transition is recorded with an author and a timestamp in an append-only event log. Agent sessions are logged with secrets redacted and costs tracked per run. Auditable end to end, from PRD upload to production deploy.

Three decisions are structurally reserved for humans: plan approval, PR review, and the deploy go / no-go. There is no configuration that removes them. Nothing reaches your main branch or your production without an accountable human click, and rollback stays armed on every merged ticket.

Per-customer consistent online backups bundle the database, the encrypted vault, and the key material as one labeled set, and restores are rehearsed, not assumed. Enterprise customers can run the entire instance in their own VPC or on-prem.

Our SOC 2 program is underway. Current status, architecture documentation, and security questionnaires are available under NDA; ask in your demo or write to hello@try.loopsfinity.com. For regulated environments we support dedicated VPC and on-prem deployment with your network policies.